Eventlog Analyzer getting a lot of Alerts - Software Installation and I cannot make out what is happening.
I been getting a lot of these net.exe, net1.exe cmd.exe and find.exe on my windows server 2003 domain controllers. I ran multiple scans just to ensure something didn't get past my firewalls and virus scanners. Checked various worms and Trojans so see if possible matches. As far as I can tell these are just normal windows processes but cannot understand why it is popping up so much these last few days.
Has anyone else encounter this?
14, 2016 13:42:00
server1
Medium
Success
A new process has been created: New Process ID:
29984 Image File Name:
C:\WINDOWS\system32\cmd.exe Creator Process ID:
824 User Name:
server1$ Domain:
mydomain Logon ID:
(0x0,0x3E7)
Apr 14, 2016 13:42:00
server1
Medium
Success
A new process has been created: New Process ID:
30068 Image File Name:
C:\WINDOWS\system32\net1.exe Creator Process ID:
30872 User Name:
server1$ Domain:
mydomain Logon ID:
(0x0,0x3E7)
Apr 14, 2016 13:42:00
server1
Medium
Success
A new process has been created: New Process ID:
27108 Image File Name:
C:\WINDOWS\system32\find.exe Creator Process ID:
29984 User Name:
server1$ Domain:
mydomain Logon ID:
(0x0,0x3E7)
Apr 14, 2016 13:42:00
server1
Medium
Success
A new process has been created: New Process ID:
30872 Image File Name:
C:\WINDOWS\system32\net.exe Creator Process ID:
29984 User Name:
server1$ Domain:
mydomain Logon ID:
(0x0,0x3E7)
Apr 14, 2016 13:41:48
server1
Medium
Success
A new process has been created: New Process ID:
30836 Image File Name:
C:\WINDOWS\system32\cmd.exe Creator Process ID:
5376 User Name:
NETWORK SERVICE Domain:
NT AUTHORITY Logon ID:
(0x0,0x3E4)
Apr 14, 2016 13:41:00
server1
Medium
Success
A new process has been created: New Process ID:
30888 Image File Name:
C:\WINDOWS\system32\net1.exe Creator Process ID:
23260 User Name:
server1$ Domain:
mydomain Logon ID:
(0x0,0x3E7)
Apr 14, 2016 13:41:00
server1
Medium
Success
A new process has been created: New Process ID:
23260 Image File Name:
C:\WINDOWS\system32\net.exe Creator Process ID:
17696 User Name:
server1$ Domain:
mydomain Logon ID:
(0x0,0x3E7)